jgm / jgm/peg-markdown

Null dereference in print_odf_element function

Open
#46 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
709
Forks
139
PR merge metrics
No merged PRs in 30d

Description

## Problem Description

Note: I am aware that this project is unmaintained. However, I am still opening this issue to follow [CVE's guidelines for EOL software](https://www.cve.org/Resources/General/End-of-Life-EOL-Assignment-Process.pdf).

There is a null dereference in the `print_odf_element` function when the parser handles a specially crafted Markdown file. This could be used to perform a denial-of-service attack.

Here is a minimized proof-of-concept Markdown file that triggers the bug: [min_null_deref_print_odf_element.md](https://github.com/jgm/peg-markdown/files/12413267/min_null_deref_print_odf_element.md).

The output is as follows:

```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==761952==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000005db3b7 bp 0x000000000014 sp 0x7fffffffe030 T0)
==761952==The signal is caused by a READ memory access.
==761952==Hint: address points to the zero page.
#0 0x5db3b7 in print_odf_element /home/sanic/peg-markdown/markdown_output.c:1072:42
#1 0x5dac3a in print_odf_element_list /home/sanic/peg-markdown/markdown_output.c:892:9
#2 0x5dac3a in print_odf_element /home/sanic/peg-markdown/markdown_output.c:1054:9
#3 0x5d4c0a in print_odf_element_list /home/sanic/peg-markdown/markdown_output.c:892:9
#4 0x5d4c0a in print_element_list /home/sanic/peg-markdown/markdown_output.c:1146:26
#5 0x5dca53 in markdown_to_g_string /home/sanic/peg-markdown/markdown_lib.c:163:5
#6 0x5dce84 in markdown_to_string /home/sanic/peg-markdown/markdown_lib.c:175:11
#7 0x4c4d06 in main /home/sanic/peg-markdown/markdown.c:180:11
#8 0x7ffff7b25082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
#9 0x41c50d in _start (/home/sanic/peg-markdown/markdown+0x41c50d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/sanic/peg-markdown/markdown_output.c:1072:42 in print_odf_element
==761952==ABORTING
```

## Reproduction Steps
1. Compile the project using ASAN (Address Sanitizer). For example, `CC=afl-clang-fast AFL_USE_ASAN=1 make`.
2. Run `./markdown --to=odf min_null_deref_print_odf_element.md` (use the proof-of-concept file attached to this report).
3. Observe the null dereference in the output.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.